Need some help with figuring out why this is an issue.
I Was noticing some of my requests are getting dropped by the logstash-output-elasticsearch
So I took a HTTP Dump of the and is seems my "process.root" is being detected as a "Number but I don't get why it is a problem as my mappings never specify the root field
Here is the
- post request,
- The results
- and the mappings
Post request
POST /_bulk HTTP/1.1
Content-Length: 1379
Content-Type: text/plain;charset=ISO-8859-1
Host: localhost: 9200
Connection: Keep-Alive
User-Agent: Manticore0.4.1
Accept-Encoding: gzip,
deflate{
"index": {
"_id": null,
"_index": "proc-pidstats-2015.07.06",
"_type": "pidstats",
"_routing": null
}
}{
"file": "/proc",
"host": "coperdragon",
"type": "pidstats",
"process": {
"cmdline": "/lib/systemd/systemd --user",
"cwd": "/",
"environ": {
"LANG": "en_US.UTF-8",
"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"NOTIFY_SOCKET": "/run/systemd/notify",
"HOME": "/home/eperry",
"LOGNAME": "eperry",
"USER": "eperry",
"SHELL": "/bin/bash",
"XDG_RUNTIME_DIR": "/run/user/1000"
},
"exe": "/lib/systemd/systemd",
"fd": [
],
"root": "/",
"nlwp": 1,
"io": {
"rchar": 126250,
"wchar": 89,
"syscr": 380,
"syscw": 14,
"read_bytes": 12288,
"write_bytes": 0,
"cancelled_write_bytes": 0
},
"pid": 969,
"comm": "systemd",
"state": "S",
"ppid": 1,
"pgrp": 969,
"session": 969,
"tty_nr": 0,
"tpgid": -1,
"flags": 4202752,
"minflt": 708,
"cminflt": 28,
"majflt": 0,
"cmajflt": 0,
"utime": 0,
"stime": 0,
"cutime": 0,
"cstime": 0,
"priority": 20,
"nice": 0,
"itrealvalue": 0,
"starttime": 4598,
"vsize": 43773952,
"rss": 1144,
"rlim": "18446744073709551615",
"startcode": 140676395724800,
"endcode": 140676397013836,
"startstack": 140730179294528,
"kstkesp": 140730179291560,
"kstkeip": 140676388357331,
"signal": 0,
"blocked": 671173123,
"sigignore": 4096,
"sigcatch": 0,
"wchan": "18446744071581185509",
"nswap": 0,
"cnswap": 0,
"exit_signal": 17,
"processor": 2,
"rt_priority": 0,
"policy": 0,
"name": "systemd",
"uid": 1000,
"euid": 1000,
"gid": 1000,
"egid": 1000
},
"@version": "1",
"@timestamp": "2015-07-06T21:36:09.811Z"
}
Response
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Content-Length: 267
{
"took": 1,
"errors": true,
"items": [
{
"create": {
"_index": "proc-pidstats-2015.07.06",
"_type": "pidstats",
"_id": "AU5lTDVUNEZxVejXPVEr",
"status": 400,
"error": "MapperParsingException[failed to parse [process.root]]; nested: NumberFormatException[For input string: \"/\"]; "
}
}
]
}
Mappings
{
"logstash": {
"order": 0,
"template": "logstash-*",
"settings": {
"index.refresh_interval": "5s"
},
"mappings": {
"_default_": {
"dynamic_templates": [
{
"message_field": {
"mapping": {
"index": "analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "message"
}
}
,
{
"string_fields": {
"mapping": {
"index": "analyzed",
"omit_norms": true,
"type": "string",
"fields": {
"raw": {
"index": "not_analyzed",
"ignore_above": 256,
"type": "string"
}
}
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"properties": {
"geoip": {
"dynamic": true,
"properties": {
"location": {
"type": "geo_point"
}
},
"type": "object"
},
"@version": {
"index": "not_analyzed",
"type": "string"
}
},
"_all": {
"enabled": true,
"omit_norms": true
}
}
},
"aliases": { }
},
"output-es-template": {
"order": 0,
"template": "proc-*",
"settings": {
"index.refresh_interval": "30s"
},
"mappings": {
"_default_": {
"dynamic_templates": [
{
"message_field": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "message"
}
}
,
{
"string_fields": {
"mapping": {
"index": "not_analyzed",
"omit_norms": true,
"type": "string"
},
"match_mapping_type": "string",
"match": "*"
}
}
],
"properties": {
"@version": {
"index": "not_analyzed",
"type": "string"
}
},
"_all": {
"enabled": true,
"omit_norms": true
}
}
},
"aliases": { }
}
}